Cloudflare security-audit-skill Explained

security-audit-skill is an open-source (MIT) agent skill from Cloudflare that turns a coding agent such as Claude Code into a vulnerability auditor running six phases: recon, hunting, validation, structured output, independent verification and reporting. Separate agents hunt for bugs and try to disprove them, and the results land in a machine-readable findings.json with evidence. It is a strong first-pass screening tool for code you own, but every result still needs human review.

The repository was published on June 18, 2026 and showed roughly 47k stars on GitHub as of October 2026. Cloudflare describes it as the single-repo starting point of its internal vulnerability discovery harness. This guide draws on the GitHub README, Cloudflare's official blog post and third-party write-ups to cover installation, usage, differences from related tools and caveats. Anything the maintainers have not stated, such as guaranteed agent support, false-positive rates or run costs, is marked as not disclosed.

It is a skill (a SKILL.md plus supporting reference files) for coding agents. Point an agent at a repository and ask for a security audit, and it runs isolated sub-agents in sequence, keeping only vulnerability leads whose attack path has been traced. Cloudflare's blog post, Build your own vulnerability harness, says the project started as a roughly 450-line skill run on one repository and grew in about six weeks into an internal harness scanning 128 repositories. What is published is that single-repo starting point; the fleet-scale harness is not public, and while Cloudflare says it may follow, no date is disclosed.

- 1. Recon: maps architecture, trust boundaries, input surfaces and prior evidence into architecture.md and coverage-ledger.json
- 2. Coverage-led hunting: isolated hunters work through ledger units while coverage critics flag gaps
- 3. Candidate validation: a fresh verifier tries to disprove each candidate
- 4. Structured output: writes confirmed, needs_validation and rejected records to findings.json, checked against report-schema.json
- 5. Independent verification: further fresh agents re-check the final source claims
- 6. Reporting: produces REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md

The verdicts are strict. Confirmed means a complete source trace with a bounded observed result; needs_validation means one exact fact is still unresolved, and no severity is assigned; rejected means a disproved lead. Mere defense-in-depth gaps are classed as hardening notes rather than vulnerabilities. Runs can be tuned with quick, standard and deep profiles: per a third-party guide (SmartScope), quick suits small targets and re-runs, while deep suits large or high-risk targets and adds an independent second pass. Later runs read earlier ledgers and findings to fill gaps, and the README and blog report that in Cloudflare's tests a single run found roughly half of what repeated runs found in total. The tool is designed to be run more than once.

The Skills CLI (npx skills) lets you choose which agent to install for. The skill itself is free; the cost is the model usage of whichever coding agent you run it in. Because it fans out many sub-agents, large repositories can burn a lot of tokens, but no official estimate is given. Validation that involves running target code (builds, tests, fuzzers) is only allowed inside an OS-enforced sandbox with external networking disabled, an allowlisted environment, resource limits and restricted write paths. Without such a sandbox the skill does not execute target code and leaves the lead as needs_validation.

- 1. Confirm authorization: audit only code you own or have explicit permission to test. Never run dynamic checks against someone else's service or project
- 2. Install the skill: run the npx skills add command above and pick your agent
- 3. Ask the agent: open the agent in the target repository and use the prompt below to start full audit mode
- 4. Pick an output location: by default reports go to ~/security-audit-skill/<repo-name>/run-<N>; the skill writes inside the repo only if you choose a directory that version control ignores
- 5. Read REPORT.md and NEEDS-VALIDATION.md: even for confirmed findings, follow the cited code yourself to confirm reproducibility
- 6. Re-run if needed: the second run reads the first run's ledger and fills gaps; in Cloudflare's tests more runs surfaced more bugs

A rough rule of thumb: for identical results on every CI run, use deterministic static analysis such as Semgrep or CodeQL; for a fast review of a diff, use /security-review; for validation and patches wired into CI, Codex Security fits. security-audit-skill complements them when you want agent-driven exploration to surface logic flaws and authorization gaps that span many files. Cloudflare's blog notes that Semgrep was wired into its own harness but the hunters never invoked it, which suggests the two approaches play different roles. SkillSpector targets skills rather than application code, so its purpose differs from this tool's.

- Do not use it on code you are not authorized to test: audit only code you control or have permission to examine. Dynamic testing of third-party systems can amount to unauthorized access
- Always review results by hand: false-positive and false-negative rates are not disclosed, and Cloudflare's blog says it claims no false-negative rate. Hunters are deliberately tuned to over-report, so filtering is expected
- It is not a replacement for a professional assessment: a formal vulnerability assessment of a production service, or one meant for auditors or customers, needs qualified specialists
- It depends on your environment: installing the skill does not guarantee a full audit, and results vary with the agent, the model and parallel sub-agent support. User reports on GitHub include issues on Windows, ZIP installs and stalled parallel sub-agents in some agents
- No dynamic validation without a sandbox: without an OS-enforced sandbox it will not run target code and stops at needs_validation
- Mind where your code goes: repository content is sent to your model provider, so check contracts and settings before using it on sensitive code
- It does not fix anything: its job is to find and report; applying fixes is up to you

For related reading, see NVIDIA SkillSpector for vetting skills before you install them, the Codex Security CLI guide for an open-source CLI that fits into CI, and first steps in security for small businesses for where to start. Costs of a formal vulnerability assessment are covered in vulnerability assessment costs.